dd0c/products/05-aws-cost-anomaly/product-brief/brief.md

dd0c/cost — Product Brief

AWS Cost Anomaly Detective

Version: 1.0
Date: February 28, 2026
Author: Product Management
Status: Conditional GO (4-1 Advisory Board Vote)
Classification: Investor-Ready

---

1. EXECUTIVE SUMMARY

Elevator Pitch

dd0c/cost is a real-time AWS billing anomaly detector that catches cost spikes in seconds — not the 24-48 hours that AWS native tools require — and delivers actionable Slack alerts with one-click remediation. At $19/account/month, it's the smoke detector with a fire extinguisher attached: it tells you what happened, who did it, and lets you fix it without leaving Slack.

Problem Statement

Cloud cost management is broken at the speed layer. AWS customers collectively overspend by an estimated $16B+ annually on idle, forgotten, and misconfigured resources (Flexera State of the Cloud 2025). The average startup discovers cost anomalies 48-72 hours after they begin — by which time a single forgotten GPU instance has burned $1,400+ (p3.2xlarge at $12.24/hr × 4.8 days).

The root cause is architectural: every existing tool — including AWS's own Cost Anomaly Detection — is built on batch-processed Cost and Usage Report (CUR) data. CUR is designed for accounting, not operations. It's like getting your credit card statement a month late and wondering why you're broke.

Three compounding failures make this worse:

1. No real-time feedback loop. AWS makes it trivially easy to launch a $98/hour GPU instance and provides zero immediate cost signal. Engineers get no feedback between "I created a thing" and "the bill arrived."
2. No attribution. When costs spike, the first question is "who did this?" AWS Cost Explorer answers at the service level ("EC2 went up"), not the human level ("Sam launched 4 GPU instances at 11:02 AM"). This creates blame culture instead of resolution.
3. No remediation path. Even when anomalies are detected, fixing them requires navigating 5+ AWS console screens. The gap between "knowing" and "doing" is where money burns.

The AI infrastructure boom has made this exponentially worse. Enterprise AI/ML spend on AWS grew 340% from 2023-2025 (Gartner). GPU instances costing $12-$98/hour are now routine. Teams that never worried about AWS costs are suddenly getting $40K bills because someone left a SageMaker endpoint running over a weekend.

Solution Overview

dd0c/cost replaces the industry's batch-processing paradigm with real-time event-stream analysis:

• Real-time detection via CloudTrail: Instead of waiting for CUR data, dd0c processes CloudTrail events through EventBridge as they happen. When someone launches an expensive resource, dd0c knows in seconds — not days.
• Slack-native alerts with full context: Every alert includes what happened, who did it, when, estimated cost impact, and plain-English explanation. No dashboard required.
• One-click remediation: Slack action buttons (Stop, Terminate, Schedule Shutdown, Snooze) let engineers fix problems without leaving their workflow. Remediation includes safety nets (automatic EBS snapshots before termination).
• Zombie resource hunting: Daily automated scans for idle EC2 instances, unattached EBS volumes, orphaned Elastic IPs, and empty load balancers — the perpetual waste that regenerates as teams grow.
• Pattern learning: Anomaly baselines adapt to each account's unique spending patterns over 30-90 days, reducing false positives and increasing detection accuracy over time.

Target Customer

Primary: Series A/B SaaS startups. 10-50 engineers. 1-5 AWS accounts. $5K-$50K/month AWS spend. No dedicated FinOps team. The CTO or a senior DevOps engineer "owns" the bill as a side responsibility.

Secondary: Mid-market engineering teams (50-200 engineers) with a solo FinOps analyst drowning in manual data wrangling across 10-25 AWS accounts.

Anti-target: Enterprise organizations with $500K+/month AWS spend, dedicated FinOps teams, and existing CloudHealth/Vantage contracts. These are not our customers in Year 1.

Key Differentiators

Dimension	dd0c/cost	Industry Standard
Detection speed	Seconds (CloudTrail events)	24-48 hours (CUR/Cost Explorer)
Alert channel	Slack-native with action buttons	Email/SNS, dashboard visits
Remediation	One-click from Slack	Manual AWS Console navigation
Attribution	Resource + user + action + timestamp	Service-level aggregates
Setup time	5 minutes (one-click CloudFormation)	15-60 minutes (CUR configuration, dashboard setup)
Price	$19/account/month	$100-500+/month or enterprise contracts
Explanation quality	Plain English ("Sam launched 4x p3.2xlarge at 11:02am, burning $12.24/hr")	"Anomaly detected in EC2"

---

2. MARKET OPPORTUNITY

Market Sizing

Segment	Size	Basis
TAM	$16.5B	Global cloud cost management and optimization market, 2026. All providers, all segments, all tool categories. (Gartner, FinOps Foundation, Flexera State of the Cloud 2025). 22% CAGR.
SAM	$2.1B	AWS-specific cost anomaly detection and optimization for SMB/mid-market. ~340,000 AWS accounts spending $5K-$500K/month. Average willingness-to-pay ~$500/month for cost tooling.
SOM	$1.0-3.6M ARR (Year 1)	250 paying accounts at blended $29/account/month from dd0c/cost alone = ~$87K MRR / $1.04M ARR. Combined with dd0c/route ("gateway drug" pair), $2-3.6M ARR if execution is sharp.

The honest math: To hit $50K MRR (the platform target), dd0c/cost alone won't get there. At $19/account/month, you need ~2,600 paying accounts for $50K MRR from cost alone. Realistically, dd0c/cost contributes $15-25K MRR and dd0c/route carries the rest. That's the strategy — the gateway drug pair, not a single product.

Competitive Landscape

Direct Competitors

AWS Cost Anomaly Detection (Native)

• Free. ML-based. 24-48 hour detection delay. Black-box model with legendary false positive rates. No Slack integration. No remediation. UX buried behind 4 clicks in the Billing console. AWS's incentive structure is fundamentally misaligned — they profit when you overspend. They will never build a great cost reduction tool.
• Threat level: LOW as a product. HIGH as a "good enough" excuse for prospects to do nothing.

Vantage

• Modern FinOps platform. Series A ($13M). Cost reporting, K8s allocation, unit economics. Pricing starts ~$100/month, scales aggressively. Architecture is CUR-based (batch, not real-time). Moving upmarket toward FinOps analyst persona, not startup CTOs.
• Threat level: MEDIUM. Could add real-time detection but would require a data pipeline rebuild (~6 month project). Window exists.

nOps

• Automated cloud optimization (RI/SP purchasing, scheduling, spot migration). Enterprise-focused, opaque pricing ("Contact Sales"). Solves "help me save money systematically" — a different JTBD than "tell me the second something goes wrong."
• Threat level: LOW-MEDIUM. Different positioning. Potential partner.

Antimetal

• Group buying for cloud. Aggregates purchasing power for better RI/SP rates. Visibility features are table stakes. VC-backed, burning cash on a model requiring massive scale.
• Threat level: LOW. Different business model entirely.

Adjacent Competitors (Different Buyer, Overlapping Problem)

CloudHealth (VMware/Broadcom) — Enterprise. 6-month implementations. $50K+ annual contracts. Sells to VP of Infrastructure via golf courses. Irrelevant to our beachhead. NEGLIGIBLE.

Kubecost / OpenCost — K8s-only cost monitoring. Our beachhead customers are mostly running EC2, Lambda, and RDS. Complementary, not competitive. NEGLIGIBLE.

Infracost — Pre-deploy cost estimation (shift-left). We're runtime (shift-right). "Infracost tells you what it WILL cost. dd0c tells you what it IS costing." Potential PARTNER.

ProsperOps — Autonomous discount management. Pure savings execution. No anomaly detection. Different JTBD. NEGLIGIBLE.

The Existential Threat

Datadog

• Already has agents in customer infrastructure, CloudTrail ingestion, and Slack integrations. Adding real-time cost anomaly detection is a feature for them, not a product. 3,000 engineers.
• Why we might still win: Datadog charges $23/host/month for infrastructure monitoring PLUS additional for cost management. A 50-host startup pays $1,150/month before cost features. Our $19/account/month is a rounding error. Their cost management is dashboard-first, not Slack-first. Their incentive is upselling more Datadog, not being the best cost tool.
• Threat level: HIGH long-term. LOW short-term (enterprise focus, not startups).

Blue Ocean Positioning

The incumbents cluster around reporting, governance, dashboards, and RI optimization — a Red Ocean of commoditized features. dd0c/cost's Blue Ocean is the quadrant nobody serves well:

Factor                    | AWS Native | Vantage | CloudHealth | dd0c/cost
--------------------------|-----------|---------|-------------|----------
Detection Speed           |     2     |    4    |      3      |    9
Attribution (Who/What)    |     2     |    6    |      7      |    8
Remediation (Fix It)      |     1     |    2    |      3      |    9
Slack-Native Experience   |     1     |    3    |      1      |   10
Time-to-Value (Setup)     |     6     |    4    |      2      |    9
Pricing Transparency      |    10     |    6    |      1      |   10
Multi-Account Governance  |     4     |    7    |      9      |    3
Reporting/Dashboards      |     5     |    8    |      9      |    2
RI/SP Optimization        |     3     |    6    |      8      |    1

We deliberately score LOW on governance, reporting, and RI optimization. We score so high on speed, action, and simplicity that the comparison is absurd. This is textbook Blue Ocean: make the competition irrelevant by competing on different factors.

Timing Thesis: Why Now

Four converging forces create an exceptional window:

1. The AI Spend Explosion (2024-2026) Enterprise AI/ML infrastructure spend on AWS grew 340% from 2023-2025. GPU instances cost $12-$98/hour. A single forgotten ML training job burns $5,000 in a weekend. Teams that never worried about AWS costs are suddenly panicking at $40K bills. This is creating a new generation of buyers who need cost detection urgently.

2. FinOps Goes Mainstream FinOps Foundation membership grew from 5,000 to 31,000+ between 2022-2025. "FinOps" job titles increased 4x on LinkedIn. The market is educated — we don't need to explain WHY cost management matters. We need to explain why our approach is better. Much easier sell.

3. AWS Native Tools Are Still Terrible AWS Cost Anomaly Detection launched in 2020. Six years later: 24-48 hour delays, no Slack, no remediation, black-box ML. AWS's billing team is a cost center, not a profit center. They have no incentive to invest heavily. Every year they don't fix this, the third-party market grows. We have 2-3 years minimum before AWS could ship something competitive.

4. Regulatory Tailwinds EU DORA requires financial institutions to monitor cloud spend. SOC 2/ISO 27001 auditors increasingly ask "how do you monitor cloud costs?" ESG/sustainability reporting links cloud efficiency to carbon footprint. FinOps Foundation certification is creating a professional class of buyers who actively seek tools.

---

3. PRODUCT DEFINITION

Value Proposition

For startup CTOs and DevOps engineers who are personally accountable for AWS spend but have no time or tools for real-time cost governance, dd0c/cost is a Slack-native cost anomaly detector that catches billing spikes in seconds and lets you fix them with one click. Unlike AWS Cost Anomaly Detection, Vantage, or CloudHealth, dd0c/cost is built on real-time CloudTrail event streams (not batch CUR data), delivers alerts where engineers already work (Slack, not dashboards), and includes remediation — not just detection — at $19/account/month.

The core promise: The 48-hour blindspot between "something went wrong" and "I understand what happened" is eliminated. dd0c/cost turns a $4,700 weekend disaster into a $12 blip caught in 60 seconds.

Personas

Persona 1: Alex — The Startup CTO

• Profile: 32, Series A startup, 12 engineers. Wears CTO/VP Eng/DevOps hat simultaneously. Personally signed the AWS Enterprise Agreement. The board sees every line item.
• Defining moment: Tuesday 7:14 AM, brushing teeth. CFO forwards AWS billing alert: charges exceeded $8,000 (last month was $2,100). Stomach drops. Cost Explorer takes 11 seconds to load on mobile. Bar chart shows a spike but not WHERE or WHY. Alex spends 3 hours diagnosing what dd0c would have caught in 60 seconds.
• JTBD: "When I see an unexpected AWS charge, I want to instantly understand what caused it and who's responsible, so I can fix it before it gets worse and explain it to stakeholders."
• What they hire dd0c for: Speed of detection, attribution, credibility with investors.

Persona 2: Sam — The DevOps Engineer

• Profile: 26, backend/infrastructure engineer at a 40-person startup. Manages Terraform, CI/CD, and "whatever AWS thing is broken today." Doesn't think about costs until they cause a problem.
• Defining moment: Friday 4:47 PM. CTO Slack: "Did you launch those GPU instances?" Sam spun up 4x p3.2xlarge on Tuesday for a 20-minute ML benchmark. Production incident pulled them away. Instances still running. 4 days × $12.24/hr × 4 instances = $4,700. Sam wants to disappear.
• JTBD: "When I spin up a temporary resource, I want automatic safety nets so I can focus on my actual work without worrying about zombie resources."
• What they hire dd0c for: The safety net they never had. No more blame. No more forgotten instances.

Persona 3: Jordan — The Solo FinOps Analyst

• Profile: 28, mid-size SaaS (150 engineers, 23 AWS accounts). Title is "Cloud Financial Analyst." The only person who understands AWS billing. Reports to VP Eng and dotted-line to Finance.
• Defining moment: Last Thursday of the month. 14 browser tabs open. 3 days building the monthly cost report. $4,200 discrepancy between Cost Explorer and CUR data. 60% of time spent collecting and reconciling data, not analyzing it.
• JTBD: "When an anomaly is detected, I want to immediately see the root cause with full context, so I can resolve it without a 3-hour investigation."
• What they hire dd0c for: Getting their time back. Automated detection replaces manual data wrangling.

Feature Roadmap

MVP (V1) — Launch at Day 90

The V1 is ruthlessly scoped to three capabilities: detect, alert, fix.

Real-Time Anomaly Detection

• CloudTrail → EventBridge → Lambda pipeline for real-time event ingestion
• Z-score anomaly scoring with configurable sensitivity (default: conservative/high threshold)
• Cost estimation for top 20 AWS services mapped from CloudTrail events (~85% accuracy)
• Two-layer architecture: Layer 1 (CloudTrail, seconds, estimated) + Layer 2 (CloudWatch EstimatedCharges + CUR, hours, precise)
• Pattern baseline learning over 30-90 days per account

Slack-Native Alerts

• Block Kit messages: resource type, estimated cost/hour, who created it (IAM user/role), when, plain-English explanation
• Action buttons: Stop Instance, Terminate Instance (with automatic EBS snapshot), Snooze (1hr/4hr/24hr/permanent), Mark as Expected (retrains baseline)
• Daily digest: yesterday's spend summary, top anomalies, zombie resources found
• End-of-month spend forecast

Zombie Resource Hunter

• Daily automated scan: idle EC2 instances (CPU <5% for 72+ hours), unattached EBS volumes, orphaned Elastic IPs, empty load balancers, stopped instances with attached EBS
• Slack report with one-click cleanup actions

Onboarding

• One-click CloudFormation template (IAM read-only role, ~90 seconds)
• Slack OAuth integration (~30 seconds)
• Immediate zombie scan on connection (first value in <10 minutes)
• Zero configuration required — opinionated defaults for everything

What V1 explicitly does NOT include: No web dashboard. No multi-account governance. No RI/SP optimization. No team attribution. No multi-cloud. No reporting. No forecasting beyond end-of-month estimate. These are deliberate omissions, not gaps.

V2 — Months 4-6

• Web dashboard: Lightweight cost overview, anomaly history, trend visualization
• Multi-account support: Connect multiple AWS accounts, unified alerting
• Team attribution: Tag-based cost allocation to teams without requiring perfect tagging (heuristic matching via IAM roles and resource naming patterns)
• Budget circuit breakers: Automatic alerts and optional enforcement when spend exceeds configurable thresholds
• Approval workflows: Remediation actions on sensitive resources require manager approval via Slack thread
• Business tier pricing ($49/account/month) with team features and API access

V3 — Months 7-12

• RI/SP optimization recommendations: Identify savings plan and reserved instance opportunities
• Spend forecasting: ML-based monthly and quarterly projections with confidence intervals
• Benchmarking: "Companies similar to yours spend X on EC2" — powered by anonymized aggregate data across dd0c customers (requires 500+ customer scale)
• Custom anomaly rules: User-defined detection logic beyond statistical baselines
• Autonomous remediation (opt-in): Auto-terminate dev/staging zombies after configurable idle period, with notification

V4 — Year 2

• Multi-cloud: GCP and Azure support (the play if AWS improves native tools)
• API platform: Programmatic access for custom integrations and internal tooling
• dd0c platform integration: Deep cross-sell with dd0c/route, dd0c/alert, dd0c/run

User Journey

AWARENESS                    ACTIVATION                     RETENTION                      EXPANSION
─────────────────────────    ─────────────────────────      ─────────────────────────      ─────────────────────────
"Your AWS bill is lying      "Start Free" → GitHub/         First zombie scan alert        Connect 2nd AWS account
to you" blog post /          Google SSO (no credit card)    within 10 minutes of setup     ($19/mo each)
Show HN / Reddit /                                                                        
aws-cost-cli OSS tool        One-click CloudFormation       First real-time anomaly        Upgrade to Business tier
                             (90 sec) → Slack OAuth         alert → one-click fix →        for team attribution
"What's That Spike?"         (30 sec) → Choose channel      "dd0c just saved us $X"        
blog series                  (10 sec)                                                      Cross-sell dd0c/route
                                                            Pattern learning kicks in      (LLM cost routing)
Bill Shock Calculator        DONE. Total: 3-5 minutes.      (30-90 days) → fewer           
(free ungated web tool)      Zero configuration.            false positives → trust         dd0c/alert, dd0c/portal
                                                            deepens → switching cost        (platform expansion)
                                                            increases

Critical conversion points:

1. Signup → Connected account: Must happen in same session. If they leave, 70% never return.
2. Connected → First alert: Must happen within 24 hours (zombie scan provides this). If no alert in 48 hours, they forget dd0c exists.
3. First alert → First action: The moment they click "Stop Instance" in Slack and it works, they're hooked. This is the product's magic moment.

The Core Technical Tension: Speed vs. Accuracy

dd0c/cost's architecture resolves the fundamental tradeoff that defines the market:

Layer	Source	Speed	Accuracy	Purpose
Layer 1: Event Stream	CloudTrail + EventBridge	Seconds	~85% (estimated, on-demand pricing)	"ALERT: New expensive resource detected"
Layer 2: Billing Reconciliation	CloudWatch EstimatedCharges + CUR	Minutes to hours	99%+ (includes RIs, SPs, Spot)	"UPDATE: Confirmed cost impact is $X"

Design principle: Alert on Layer 1 (fast, estimated). Reconcile with Layer 2 (slow, precise). Always show the user which layer they're seeing. Never pretend an estimate is exact. Never wait for precision when speed saves money.

This is a smoke detector vs. a fire investigation. The smoke detector goes off immediately — it might be burnt toast, it might be a real fire. You don't wait for the fire investigator's report before evacuating.

Pricing

Tier Structure

Tier	Price	Includes	Purpose
Free	$0/month	1 AWS account, daily anomaly checks (not real-time), Slack alerts without action buttons, weekly zombie report	Top of funnel. Deliver value. Create upgrade motivation via visible delay.
Pro	$19/account/month	Real-time CloudTrail detection, Slack alerts WITH action buttons, daily zombie hunter, end-of-month forecast, daily digest, configurable sensitivity	Core product. 80% of revenue.
Business	$49/account/month (or $399/month flat for ≤20 accounts)	Everything in Pro + team attribution, approval workflows, custom anomaly rules, API access, priority support	Expansion revenue. Launches with V2.

Why $19/month

1. Impulse purchase threshold. $19 doesn't require approval from anyone. $49 might. Conversion rate difference is typically 2-3x for developer tools.
2. Multi-account expansion. 3 accounts = $57/month. 10 accounts = $190/month. Revenue scales naturally with customer growth.
3. Trivial ROI. One forgotten GPU instance ($12.24/hr × 48hr = $587) pays for 2.5 years of dd0c. The ROI story doesn't need a spreadsheet.
4. Category positioning. At $19, we're 5-25x cheaper than Vantage. That's not a price difference — it's a category difference. We're not "cheaper Vantage." We're a different thing.

Free-to-Paid Conversion Mechanics

The free tier is deliberately designed to create upgrade pressure:

• Free gets daily checks. Pro gets real-time. Every free alert includes: "We detected this anomaly 18 hours ago. On Pro, you'd have known in 60 seconds. Estimated cost of the delay: $220."
• Free alerts have NO action buttons. You see the problem but must switch to AWS Console to fix it. The friction is the upgrade motivation.
• Target conversion rate: 2.5-3.5% (consistent with developer tool benchmarks: Vercel 2.5%, Supabase 3.1%, Railway 2.8%).

---

4. GO-TO-MARKET PLAN

Launch Strategy: Product-Led Growth (PLG)

No sales team. No demos. No "Contact Sales" button. The product sells itself or it doesn't sell at all.

The GTM motion is built on one principle: time-to-value under 10 minutes. A startup CTO should go from "I've never heard of dd0c" to "I just got my first anomaly alert in Slack" in a single sitting. If onboarding takes more than 5 minutes, we lose 60% of signups.

The Onboarding Flow (Critical Path)

1. Landing page → "Start Free" (no credit card)
2. Sign up with GitHub or Google (no email/password forms)
3. "Connect Your AWS Account" → One-click CloudFormation template
   → Opens AWS Console with pre-filled CF stack
   → Creates IAM role with read-only permissions
   → Outputs role ARN back to dd0c
   → Total: 90 seconds (including AWS Console login)
4. "Connect Slack" → Standard Slack OAuth flow (30 seconds)
5. "Choose a channel for alerts" → Dropdown (10 seconds)
6. DONE. "We're monitoring your account. First alert incoming."

Immediate value delivery: The moment the account connects, dd0c runs a zombie resource scan. Most accounts have at least one idle resource. First Slack alert within 5-10 minutes: "We found 3 potentially unused resources costing $127/month." This is the aha moment.

Beachhead: Startups Burning AWS Credits

The Ideal First Customer

Series A or B SaaS startup. 10-40 engineers. 1-3 AWS accounts. $5K-$50K/month AWS spend. No FinOps person. The CTO owns the bill as a side responsibility.

Why this profile works:

• Pain is acute and personal. The CTO's name is on the account. The board sees every line item.
• Decision cycle is fast. One person decides. No procurement. No security review committee. Sign up and be live in 10 minutes.
• $19/month is a non-decision. Less than one engineer's daily coffee. If dd0c catches ONE forgotten GPU instance, it pays for itself for 5 years.
• They talk to each other. Startup CTOs are in Slack communities (Rands Leadership, CTO Craft, YC groups), Twitter/X, and FinOps meetups. One happy customer generates 3 referrals.
• AWS credits make it free. YC gives $100K in AWS credits. Via AWS Marketplace listing, dd0c becomes "free" — paid from credits they'd spend anyway.

The First 10 Customers Playbook

1. Customers 1-3: Network. Brian is a senior AWS architect. Call people running startups on AWS. "I built something. Try it, give me honest feedback." Design partners — free for 6 months in exchange for weekly 15-minute feedback calls.
2. Customers 4-7: Hacker News + Reddit launch. "Show HN: I built a real-time AWS cost anomaly detector." Tuesday or Wednesday morning US time. Product polished, landing page sharp, onboarding bulletproof. One shot at first impression.
3. Customers 8-10: Referrals from 1-7. If the first 7 don't refer anyone, the product isn't good enough. Go back to step 1.

Growth Loops

Loop 1: Savings-Driven Virality

Customer saves $X → Shares "dd0c saved us $4,700" on Twitter/Slack community
→ Peers sign up → They save $X → They share → Repeat

Amplifier: Monthly "savings report" email with shareable stats. Make it easy to brag about being smart with money.

Loop 2: Engineering-as-Marketing (Open Source Tools)

Free CLI tool (aws-cost-cli, zombie-hunter) → GitHub stars → Developer awareness
→ "Like this? dd0c does this automatically, in real-time" → Signups → Repeat

Each tool solves a small problem and funnels to dd0c for the full solution.

Loop 3: Content SEO Flywheel

"What's That Spike?" blog post → Ranks for "AWS NAT Gateway cost spike"
→ CTO Googles exact problem → Finds post → "dd0c would have caught this in 60 seconds"
→ Signup → Repeat

Each post targets a long-tail keyword that the ICP searches when they have the exact problem dd0c solves.

Loop 4: Cross-Sell from dd0c/route

Customer uses dd0c/route (LLM cost routing) → Saves $400/month on OpenAI
→ Sees dd0c/cost in same workspace → "Oh, this monitors AWS too?"
→ Connects AWS account → Finds $800/month in zombies → Platform lock-in deepens

This is the "gateway drug" strategy. Money saved on LLM costs earns the right to sell AWS cost monitoring.

Content Strategy

Pillar 1: "AWS Bill Shock Calculator" (Lead Generation)

Free, ungated web tool. Input your monthly AWS bill → Output: "Companies your size waste 25-35%. That's $X-$Y/month. Here are the top 5 sources." CTA: "Want to find YOUR specific waste? Connect your AWS account (free)." Shareable, generates organic backlinks.

Pillar 2: "What's That Spike?" Blog Series (SEO + Authority)

Recurring series dissecting real AWS cost anomalies (anonymized):

• "The NAT Gateway That Ate $3,000"
• "When Autoscaling Doesn't Scale Back"
• "The $5,000 GPU Instance Nobody Remembered"
• "CloudWatch Logs Gone Wild"

Each post targets a specific long-tail SEO keyword that the ICP searches during an active cost crisis.

Pillar 3: "The Real-Time FinOps Manifesto" (Category Creation)

A single definitive piece establishing "real-time FinOps" as a recognized subcategory. If we define the category, dd0c is the default leader. Target: FinOps Foundation blog, The New Stack, InfoQ.

Pillar 4: Open-Source Tools (Engineering-as-Marketing)

• aws-cost-cli: CLI showing current AWS burn rate. npx aws-cost-cli → "Current burn rate: $1.87/hour | $44.88/day | $1,346/month."
• zombie-hunter: CLI scanning for unused AWS resources. npx zombie-hunter → "Found 7 zombie resources costing $312/month."
• CloudFormation billing alerts template: One-click CF template for proper billing alerts (better than AWS default). Free, dd0c branded.

Channel Strategy

Channel	Tactic	Expected Yield
Hacker News	"Show HN" launch post	500-2,000 signups if front page. 2-5% convert.
r/aws, r/devops	Genuine participation + "I built this"	100-500 signups. Higher conversion (self-selected).
Twitter/X	"Your AWS bill is lying to you" thread	Brand awareness. 50-200 signups per viral thread.
FinOps Foundation Slack	Community participation, answer questions	10-30 high-quality leads. Most educated buyers.
Dev.to / Hashnode	Technical blog posts	SEO long-tail. 10-30 signups/month ongoing.
AWS Marketplace	Listed within 90 days of launch	Pay-with-credits angle. AWS takes 3-5% cut. Worth it.
Product Hunt	Same launch week as HN, different day	200-500 signups. Lower conversion but brand awareness.

Partnerships

AWS Marketplace (Priority: HIGH) — List within 90 days. Customers pay using existing AWS committed spend/credits. YC startups with $100K in AWS credits can use dd0c for "free." Revenue impact: AWS takes 3-5%, worth it for distribution.

FinOps Foundation (Priority: HIGH) — Vendor membership. Contribute to framework documentation (specifically "Real-Time Cost Management" capability). Speak at FinOps X conference. Table stakes for credibility.

Infracost (Priority: MEDIUM) — Integration: Infracost for pre-deploy estimation + dd0c for post-deploy detection. Complementary products, same buyer. Cross-promotion opportunity.

90-Day Launch Timeline

Days 1-30: Build the Core

• CloudTrail → EventBridge → Lambda pipeline for real-time event ingestion
• Anomaly scoring engine (Z-score, configurable sensitivity)
• Cost estimation library (CloudTrail events → estimated hourly costs, top 20 AWS services)
• Slack app: OAuth, Block Kit alert templates, action handlers (Stop, Terminate, Snooze, Mark Expected)
• Daily digest message
• Deliverable: Working product on own AWS accounts. Ugly but functional.

Days 31-60: Polish + Design Partners

• Landing page (one-page, Vercel-style)
• GitHub/Google SSO signup
• One-click CloudFormation onboarding template
• Slack OAuth integration flow
• Immediate zombie scan on account connection
• Recruit 3-5 design partners from network. Free for 6 months, weekly feedback calls.
• Instrument: time-to-first-alert, alert-to-action ratio, false positive rate
• Deliverable: 5 real humans using it daily. Onboarding <5 minutes. False positive rate <30%.

Days 61-90: Public Launch

• Stripe billing integration ($19/account/month, free tier for 1 account)
• First "What's That Spike?" blog post
• aws-cost-cli open-source tool released
• AWS Marketplace listing application submitted
• FinOps Foundation vendor membership application
• Show HN + Reddit + Product Hunt + Twitter launch
• Personal outreach to 50 startup CTOs via LinkedIn/Twitter DMs
• Deliverable: Product live, publicly available, with paying customers.

---

5. BUSINESS MODEL

Revenue Model

Primary revenue: Per-account SaaS subscription. $19/account/month (Pro) and $49/account/month (Business, launching V2).

Secondary revenue (future): dd0c platform bundle pricing. dd0c/route + dd0c/cost bundle at $39/month flat for small teams (discount vs. buying separately). Creates pricing anchor that makes each individual product feel cheap.

Revenue characteristics:

• Recurring (monthly subscription)
• Usage-correlated (revenue scales with customer's AWS footprint — more accounts = more revenue)
• Low churn by design (pattern learning + remediation workflows create switching costs over time)
• Expansion-native (customers add accounts as they grow)

Unit Economics

Per-Customer Economics (Pro Tier, Single Account)

Metric	Value	Notes
Monthly revenue	$19	Per connected AWS account
Infrastructure cost	~$0.80/month	CloudTrail processing (Lambda), anomaly storage (DynamoDB/Postgres), Slack API calls. Estimated at scale.
Gross margin	~96%	SaaS infrastructure costs are minimal at this price point
CAC (PLG)	~$15-25	Blended across organic (HN, Reddit, SEO = $0) and paid content promotion ($50-80 per paid signup). PLG means no sales team.
Payback period	1-2 months	At $19/month revenue and $15-25 CAC
Target LTV	$190	10-month average lifetime at <10% monthly churn
LTV:CAC ratio	7.6-12.7x	Healthy. >3x is the benchmark for sustainable SaaS.

Multi-Account Expansion Economics

The real unit economics story is expansion revenue. A customer starts with 1 account ($19/month), then connects their staging account ($38/month), then their data account ($57/month). No additional CAC for expansion revenue.

Accounts	Monthly Revenue	Annual Revenue	Notes
1	$19	$228	Entry point
3	$57	$684	Typical startup (prod + staging + data)
5	$95	$1,140	Growing startup
10	$190	$2,280	Mid-market entry
20	$399 (Business flat)	$4,788	Business tier cap

Path to Revenue Milestones

$10K MRR (~526 paying accounts)

Timeline: Month 6-9 (Scenario B "The Grind")

How we get there:

• dd0c/cost: ~300 accounts × $19 = $5,700 MRR
• dd0c/route: contributing remaining ~$4,300 MRR
• Total: ~$10K MRR from the gateway drug pair

Requirements: 2,000+ free signups, 2.5% conversion, steady content marketing cadence, 2-3 "dd0c saved us $X" case studies published.

$50K MRR (~2,600 paying accounts from cost alone, or blended across platform)

Timeline: Month 12-18

How we get there (blended):

• dd0c/cost: ~1,000 accounts × $22 avg (mix of Pro + Business) = $22,000 MRR
• dd0c/route: ~$18,000 MRR
• dd0c/alert (launched Month 6): ~$10,000 MRR
• Total: ~$50K MRR across 3 modules

Requirements: Strong PLG flywheel, AWS Marketplace traction, at least one viral content moment, cross-sell motion working between route and cost.

$100K MRR

Timeline: Month 18-24

How we get there:

• 4+ dd0c modules live
• Business tier adoption driving higher ARPA
• Platform bundle pricing
• Early mid-market customers (10-25 accounts each)
• Potential: first contractor hire for customer support

Requirements: Product-market fit validated across at least 3 modules. Churn <8%. NPS >40. The platform flywheel (modules more valuable together than apart) must be demonstrably working.

Solo Founder Constraints & Mitigations

Constraint	Impact	Mitigation
No sales team	Can't do enterprise outreach	PLG motion. Product sells itself or doesn't sell.
No support team	Support burden scales with customers	Automate everything. Self-service docs. Community Slack. Hire part-time contractor at ~200 customers.
No marketing team	Limited content output	Batch content creation. 1 blog post/week. Leverage open-source tools for organic reach.
Single point of failure	Bus factor = 1	Infrastructure as code. CI/CD. Automated testing. Documented runbooks. No manual processes per customer.
Cognitive load of 6 products	Risk of building 6 mediocre products	Hard rule: no more than 2 products in active development at any time. dd0c/route + dd0c/cost first. Everything else waits.
No fundraising	Limited runway for experimentation	Bootstrap-friendly unit economics. $19/month × 96% gross margin = profitable from customer #1. No burn rate to manage.

The "Gateway Drug" Cross-Sell Economics

The dd0c platform strategy depends on the gateway drug pair (route + cost) earning the right to sell everything else:

Month 1-2:  dd0c/route launches → Customer saves $400/month on LLM costs
Month 2-3:  dd0c/cost launches → Same customer saves $800/month on AWS waste
Month 3:    Customer is saving $1,200/month across two dd0c products for ~$60/month total
Month 4-6:  dd0c/alert launches → "Save your money AND your sleep"
Month 6+:   dd0c/portal → dd0c owns the developer experience. Switching cost is massive.

Data synergy: dd0c/route knows which services make LLM API calls and their cost. dd0c/cost knows which AWS resources are running and their cost. Combined: "Your recommendation service is making $3,200/month in GPT-4o calls AND running on a $1,800/month p3.2xlarge. Here's how to cut both by 60%." Single-product competitors can't replicate this.

Technical synergy: Both products need AWS account integration, Slack integration, auth, and billing. Building dd0c/cost after dd0c/route means 50% of infrastructure already exists. Marginal engineering cost of the second product is much lower than the first.

---

6. RISKS & MITIGATIONS

Top 5 Risks

Risk 1: AWS Ships Real-Time Cost Anomaly Detection with Slack Remediation

• Likelihood: MEDIUM (40% within 2 years)
• Impact: CRITICAL — Primary differentiator evaporates overnight
• Analysis: AWS's billing team is a cost center, not a profit center. Real-time cost detection that helps customers spend LESS is antithetical to AWS's revenue model. They've had 15 years to build this and haven't. Their organizational incentives are structurally misaligned. Even if they improve, it'll be enterprise-focused, console-bound, and half-hearted.
• Mitigation: Move fast. Establish brand and switching costs (pattern data, remediation workflows) before AWS can respond. If AWS ships something competitive, pivot to multi-cloud (AWS + GCP + Azure) — something AWS will NEVER build.
• Kill trigger: If AWS announces real-time Cost Anomaly Detection with native Slack remediation at re:Invent 2026, kill the standalone product. Pivot the CloudTrail ingestion engine into dd0c/alert or dd0c/drift as a supplementary feature.

Risk 2: Market Consolidation (Datadog Acquires Vantage or Builds Equivalent)

• Likelihood: HIGH (60% within 18 months for Datadog entering the space)
• Impact: HIGH — Datadog has 3,000 engineers, $2B+ revenue, and existing customer infrastructure agents
• Analysis: Datadog charges $23/host/month. Their cost management is an upsell, not a standalone product. A startup with 50 hosts pays $1,150/month for Datadog before cost features. Our $19/account/month is a completely different price point. Datadog optimizes for enterprise, not startups.
• Mitigation: Don't compete on features. Compete on price and simplicity. Position as "the cost tool for teams that can't afford Datadog" or "teams that use Datadog for monitoring but don't want Datadog prices for cost management." If Datadog acquires Vantage, they'll inevitably raise prices or bundle behind expensive tiers. Double down on the anti-bloatware positioning.
• Pivot option: Strictly PLG for sub-50 person engineering teams where a Datadog contract is unjustifiable.

Risk 3: False Positive Fatigue Kills Retention

• Likelihood: HIGH (70% if not actively managed)
• Impact: HIGH — If the product loses trust, churn hits 100%. The "boy who cried wolf" is the death of all monitoring tools.
• Analysis: CloudTrail is noisy. Mapping raw RunInstances events to accurate pricing (factoring RIs, Savings Plans, Spot) in real-time is notoriously difficult. If the Slack bot cries wolf with inaccurate pricing three times, engineers mute the channel. Game over.
• Mitigation:
  1. Ship with hyper-conservative default thresholds (miss $50 anomalies rather than trigger 3 false positives)
  2. Every alert includes [Mark as Expected] button that instantly retrains the baseline
  3. Composite anomaly scoring (multiple signals = high confidence, single signal = low confidence)
  4. User-tunable sensitivity per service
  5. Track alert-to-action ratio as core product metric. If <20% of alerts result in action, sensitivity is too high.
  6. Be transparent about estimates: "Estimated cost: $X/hour (on-demand pricing. Actual may differ with RIs/SPs)."
• Kill trigger: Alert-to-action ratio <10% at Month 4.

Risk 4: Solo Founder Burnout (Bus Factor = 1)

• Likelihood: MEDIUM-HIGH (50% within 18 months)
• Impact: CRITICAL — Processing real-time event streams at scale is an operational nightmare. If ingestion goes down, you miss the anomaly, you lose trust forever.
• Analysis: Brian is building 6 products simultaneously. The cognitive load, support burden, and operational complexity of running a multi-product SaaS as a solo founder is extreme. Burnout is the most common startup killer.
• Mitigation:
  1. Hard rule: no more than 2 products in active development at any time
  2. Automate everything (IaC, CI/CD, automated testing, automated onboarding)
  3. Hire part-time support contractor within 6 months of launch
  4. dd0c/cost's Slack-first architecture eliminates 60% of the frontend engineering burden (no dashboard in V1)
• Kill trigger: Spending >60% of time on dd0c/cost support instead of building.

Risk 5: The "Good Enough" Trap — Free Tier Cannibalization

• Likelihood: HIGH (60-70% of signups stay free)
• Impact: MEDIUM — Revenue growth stalls despite strong signup numbers
• Analysis: The free tier (daily anomaly checks, 1 account) may be sufficient for many small startups. Daily checks catch most problems, just 24 hours late.
• Mitigation:
  1. Make the free-to-paid gap visceral. Every free alert: "We detected this 18 hours ago. On Pro, you'd have known in 60 seconds. Estimated cost of the delay: $220."
  2. Free alerts have NO action buttons. See the problem, can't fix it from Slack. Friction = upgrade motivation.
  3. Accept 60-70% free as normal for PLG. Focus on the 30-40% who convert. At $19/month, volume matters more than conversion rate.

Additional Risks (Monitored)

Risk	Likelihood	Impact	Mitigation
IAM permission anxiety blocks adoption	MEDIUM (30%)	MEDIUM	Minimal permissions (read-only), open-source agent, SOC 2 within 12 months
AI spend bubble pops	LOW-MEDIUM (20%)	MEDIUM	AI is the hook, not the product. dd0c detects ALL cost anomalies. Core problem persists regardless.
Security breach / data incident	LOW (10%)	CATASTROPHIC	Minimize data collection, encrypt everything, no stored credentials (IAM cross-account roles), bug bounty from day 1
"We'll build it internally"	MEDIUM (25%)	LOW	Self-solving. Internal tools get abandoned. Content strategy demonstrates problem depth. $19/month < one engineer's afternoon.

Kill Criteria

Non-negotiable triggers to kill dd0c/cost and redirect effort:

1. < 50 free signups within 30 days of Show HN launch. Developer community doesn't care. Problem isn't painful enough or positioning is wrong.
2. < 5 paying customers within 90 days of launch. Product-market fit isn't there at any price.
3. > 50% of paying customers churn within 60 days. Product isn't delivering enough value to justify even $19/month.
4. AWS ships real-time anomaly detection with Slack integration. Primary differentiator evaporates. Pivot or kill.
5. > 60% of time spent on support instead of building. Product complexity is wrong for solo founder operating model.

If any trigger fires, don't rationalize. Don't "give it one more month." Kill it, learn from it, move on. dd0c has 5 other products.

Pivot Options

Trigger	Pivot
AWS closes the speed gap	Pivot to multi-cloud (AWS + GCP + Azure) — something AWS will never build
Standalone product fails	Absorb CloudTrail engine into dd0c/portal as a cost widget, not a standalone product
False positive crisis	Pivot from "anomaly detection" to "Zombie Hunter" — pure unused resource detection. Zero false positives, pure savings.
Market too noisy	Rebrand as "dd0c/guard" — cost governance and guardrails, not detection. Prevention > detection.

---

7. SUCCESS METRICS

North Star Metric

Anomalies Resolved — the number of cost anomalies dd0c detected AND the customer took action on (Stop, Terminate, Schedule, or acknowledged via Mark as Expected).

Not signups. Not MRR. Not DAU. Anomalies resolved is the atomic unit of value. Every anomaly resolved is money saved, trust earned, and retention deepened. Everything else is a proxy.

Leading Indicators (Predictive)

Metric	Target	Why It Matters
Time-to-first-alert	<10 minutes	If users don't get value fast, they churn before they start
Signup → Connected account rate	>60%	Measures onboarding friction. Below 60% = onboarding is broken
Alert-to-action ratio	>25%	Product quality signal. Below 20% = false positive crisis
Weekly active accounts (WAA)	Growing 10%+ week-over-week	Engagement health. Flat = product isn't sticky
Free-to-paid conversion rate	2.5-3.5%	Revenue efficiency. Below 2% = free tier is too generous or paid value unclear

Lagging Indicators (Confirmatory)

Metric	Target	Why It Matters
MRR	Per milestone targets below	Revenue health
Monthly churn rate	<8%	Retention. Above 15% = product isn't delivering sustained value
NPS	>40	Customer satisfaction. Below 20 = product problems
Organic referral rate	>15% of new signups	Word-of-mouth health. Below 5% = product isn't remarkable enough to share
Estimated customer savings	>10x subscription cost	ROI validation. If customers aren't saving 10x what they pay, pricing or detection is wrong

30/60/90 Day Milestones

Day 30: Core Product Complete

• CloudTrail → EventBridge → Lambda pipeline operational
• Anomaly scoring engine functional (Z-score, configurable sensitivity)
• Slack app: alerts with action buttons (Stop, Terminate, Snooze, Mark Expected)
• Daily digest message working
• Tested on 2+ own AWS accounts
• Gate: Can detect a manually-created expensive resource and alert in Slack within 120 seconds

Day 60: Design Partners Active

• 3-5 design partners using the product daily
• Onboarding flow complete (CloudFormation + Slack OAuth, <5 minutes)
• Immediate zombie scan on account connection
• False positive rate <30%
• At least 1 design partner has a "dd0c saved us $X" story
• Gate: Time-to-first-alert <10 minutes for all design partners

Day 90: Public Launch

• Stripe billing live ($19/account/month, free tier)
• Show HN + Reddit + Product Hunt launched
• First "What's That Spike?" blog post published
• aws-cost-cli open-source tool released
• AWS Marketplace listing application submitted
• 200+ free signups in launch week
• Gate: At least 1 paying customer within 2 weeks of launch

Month 4 Checkpoint

• 25+ paying accounts
• $475+ MRR
• Alert-to-action ratio >25%
• Monthly churn <10%
• At least 2 organic referrals
• Kill trigger review: If <5 paying accounts, initiate kill criteria evaluation

Month 6 Checkpoint

• 100+ paying accounts
• $1,900+ MRR
• NPS >40
• Monthly churn <8%
• V2 development underway (dashboard, multi-account)
• Cross-sell motion with dd0c/route initiated
• Kill trigger review: If <25 paying accounts or >15% churn, initiate kill criteria evaluation

Metrics to Track Daily

1. New signups (free + paid)
2. Accounts connected (signup → connected conversion)
3. Anomalies detected (total, by type, by severity)
4. Anomalies acted on (stop, terminate, snooze, mark expected)
5. Alert-to-action ratio
6. Time-to-first-alert
7. False positive reports (Mark as Expected / total alerts)

Metrics to Track Weekly

1. MRR and MRR growth rate
2. Free-to-paid conversion rate
3. Churn rate (accounts disconnected or downgraded)
4. Estimated customer savings (sum of costs avoided via remediation)
5. Support ticket volume (early warning for complexity issues)

---

APPENDIX: SCENARIO PROJECTIONS

Scenario	Probability	Month 3 MRR	Month 6 MRR	Month 12 MRR	Description
A: The Rocket	20%	$2,850	$9,500	$19,000	HN front page, 2K signups week 1, 3% conversion, strong word-of-mouth
B: The Grind	50%	$475	$950	$3,800	Moderate HN traction, 500 signups week 1, slow steady growth via content
C: The Pivot	25%	$95	$285	—	Lukewarm response, 200 signups, 1.5% conversion. Rebrand as portal feature or kill.
D: The Extinction	5%	—	—	—	AWS ships competitive native tool. Kill immediately. Salvage CloudTrail engine for dd0c/alert.

Expected value (probability-weighted Month 12 MRR): ~$5,700 from dd0c/cost alone. Combined with dd0c/route, the gateway drug pair targets $10-15K MRR at Month 12 under the most likely scenario.

---

This brief synthesizes findings from four prior development phases: Brainstorm, Design Thinking, Innovation Strategy, and Party Mode Advisory Board Review. All contradictions between phases have been resolved in favor of the most conservative, execution-focused position. The advisory board voted 4-1 Conditional GO.

The bet: real-time CloudTrail analysis is an architectural wedge that incumbents can't easily follow. The condition: ship in 90 days, honor kill criteria, and stay ruthlessly focused on three things — detect fast, alert clearly, fix with one click.